How do browser cookie domains work?
https://stackoverflow.com/questions/1062963/how-do-browser-cookie-domains-work
答案一
Although there is the RFC 2965 (Set-Cookie2
, had already obsoleted RFC 2109) that should define the cookie nowadays, most browsers don’t fully support that but just comply to the original specification by Netscape.
There is a distinction between the Domain attribute value and the effective domain: the former is taken from the Set-Cookie
header field and the latter is the interpretation of that attribute value. According to the RFC 2965, the following should apply:
- If the Set-Cookie header field does not have a Domain attribute, the effective domain is the domain of the request.
- If there is a Domain attribute present, its value will be used as effective domain (if the value does not start with a
.
it will be added by the client).
Having the effective domain it must also domain-match the current requested domain for being set; otherwise the cookie will be revised. The same rule applies for choosing the cookies to be sent in a request.
Mapping this knowledge onto your questions, the following should apply:
- Cookie with
Domain=.example.com
will be available for www.example.com - Cookie with
Domain=.example.com
will be available for example.com - Cookie with
Domain=example.com
will be converted to.example.com
and thus will also be available for www.example.com - Cookie with
Domain=example.com
will not be available for anotherexample.com - www.example.com will be able to set cookie for example.com
- www.example.com will not be able to set cookie for www2.example.com
- www.example.com will not be able to set cookie for .com
And to set and read a cookie for/by www.example.com and example.com, set it for .www.example.com
and .example.com
respectively. But the first (.www.example.com
) will only be accessible for other domains below that domain (e.g. foo.www.example.com or bar.www.example.com) where .example.com
can also be accessed by any other domain below example.com (e.g. foo.example.com or bar.example.com).
答案二
The previous answers are a little outdated.
RFC 6265 was published in 2011, based on the browser consensus at that time. Since then, there has been some complication with public suffix domains. I've written an article explaining the current situation - http://bayou.io/draft/cookie.domain.html
To summarize, rules to follow regarding cookie domain:
The origin domain of a cookie is the domain of the originating request.
If the origin domain is an IP, the cookie's domain attribute must not be set.
If a cookie's domain attribute is not set, the cookie is only applicable to its origin domain.
If a cookie's domain attribute is set,
- the cookie is applicable to that domain and all its subdomains;
- the cookie's domain must be the same as, or a parent of, the origin domain
- the cookie's domain must not be a TLD, a public suffix, or a parent of a public suffix.
It can be derived that a cookie is always applicable to its origin domain.
The cookie domain should not have a leading dot, as in .foo.com
- simply use foo.com
As an example,
x.y.z.com
can set a cookie domain to itself or parents -x.y.z.com
,y.z.com
,z.com
. But notcom
, which is a public suffix.- a cookie with domain=
y.z.com
is applicable toy.z.com
,x.y.z.com
,a.x.y.z.com
etc.
Examples of public suffixes - com
, edu
, uk
, co.uk
, blogspot.com
, compute.amazonaws.com
最新文章
- thinkPHP实现静态页的方法-buildHtml
- SQL语句经典大全
- html5数字和颜色输入框
- python学习笔记(2)
- Spring 4 官方文档学习(十四)WebSocket支持
- 多次快速点击相同button导致重复响应的问题
- Java GC 面试问题
- datagridview的某些属性以及增删改查
- Java IO 技术之基本流类
- 使用VSS2005的时候报错:输入正确的服务器地址依然出错了
- PAT 1075. PAT Judge (25)
- [GIF] GIF Loop Coder - Animating with Arrays
- bzoj1559
- oracle实现自动记录存储过程、自定义函数执行错误
- C程序设计语言练习题1-7
- 怎样实现多文件上传 在iOS开发中
- label不换行的问题
- SQLite中的时间日期函数
- 自己动手写Redis客户端(C#实现)2 - SET请求和状态回复(set)
- 我的es6笔记